Nigeria’s AML/CFT and Financial Crime Framework

Money Laundering (Prevention and Prohibition) Act, 2022

The principal anti-money laundering statute in Nigeria. It replaced the 2011 Act and applies to financial institutions and to designated non-financial businesses and professions (DNFBPs). It sets the core obligations every reporting institution must meet: identifying and verifying customers and beneficial owners, applying due diligence based on risk, keeping records, maintaining internal controls and a compliance function, and reporting suspicious and threshold-based transactions to the Nigerian Financial Intelligence Unit (NFIU).

The Act also places the supervision of DNFBPs with the Special Control Unit against Money Laundering (SCUML) and provides for sanctions against institutions and individuals that fail to comply.

What it means for your program

• A documented, risk-based AML program approved at board level
• Customer and beneficial ownership identification that can be evidenced file by file
• Record keeping that supports reconstruction of transactions on request
• Clear internal escalation from frontline staff to the compliance officer, and from the compliance officer to the NFIU

Terrorism (Prevention and Prohibition) Act, 2022

Replaced the earlier terrorism prevention legislation and its amendments. It criminalizes terrorism and terrorist financing, addresses the financing of proliferation of weapons of mass destruction, and provides the legal basis for targeted financial sanctions, including the freezing of funds and assets of designated persons and entities.

The Act established the Nigeria Sanctions Committee, which oversees domestic designations and the implementation of United Nations Security Council sanctions.

What it means for your program

• Screening that covers customers, beneficial owners, counterparties, and transactions
• A tested process to freeze funds without delay when a match is confirmed, and to report the action
• Terrorist and proliferation financing risk addressed explicitly in the institution’s risk assessment

Proceeds of Crime (Recovery and Management) Act, 2022

Provides a unified framework for the restraint, seizure, confiscation, forfeiture, and management of proceeds and instruments of unlawful activity, including forfeiture that does not depend on a criminal conviction.

For financial institutions, the Act is most visible through restraint and freezing orders, information requests, and the handling of accounts and assets connected to investigations.

What it means for your program

• Procedures to receive, verify, act on, and track orders and requests from law enforcement and the courts
• Records and account information that can be produced accurately and on time
• Coordination between compliance, legal, and operations so that orders are applied consistently

CBN AML/CFT/CPF Regulations for financial institutions

The Central Bank of Nigeria’s anti-money laundering, combating the financing of terrorism, and countering proliferation financing regulations translate the Acts into detailed requirements for CBN-regulated institutions, including banks, microfinance banks, payment service providers, and bureaux de change.

They cover institution-wide risk assessment, board and senior management oversight, the role and independence of the chief compliance officer, customer due diligence and enhanced due diligence, politically exposed persons, correspondent banking, wire transfers, new products and technologies, record keeping, reporting, staff training, and independent audit of the program.

What it means for your program

• An enterprise-wide AML/CFT/CPF risk assessment that drives controls, monitoring, and staffing
• Board reporting that gives directors a clear view of risk and of program performance
• Policies and procedures that reflect how the institution actually operates
• Independent testing of the program, with findings tracked to closure

CBN Customer Due Diligence Regulations, 2023

Set out more detailed expectations for customer due diligence at CBN-regulated institutions: identification and verification of individuals and legal persons, identification of beneficial owners, risk-based simplified and enhanced measures, ongoing due diligence, and the treatment of higher-risk customers and relationships.

They operate alongside Nigeria’s identity infrastructure, including the Bank Verification Number (BVN) and the National Identification Number (NIN), which institutions use in onboarding and verification.

What it means for your program

• Customer risk rating that is consistent, documented, and refreshed when risk changes
• Beneficial ownership information for corporate customers that is collected, verified, and kept current
• Enhanced due diligence that is specific to the risk, not a generic checklist
• BVN and NIN verification built into onboarding workflows, with exceptions handled and documented

SEC Nigeria AML/CFT/CPF Regulations, 2022

The Securities and Exchange Commission’s regulations apply AML/CFT/CPF requirements to capital market operators, such as broker-dealers, fund and portfolio managers, issuing houses, and other registered operators.

They address the risks particular to the capital market, including the use of investment accounts, third-party payments, and complex ownership structures to move or disguise funds.

What it means for your program

• Due diligence on investors and beneficial owners proportionate to the products offered
• Monitoring of account activity and fund flows for patterns inconsistent with the client profile
• Reporting and record keeping aligned with both SEC and NFIU expectations

NAICOM AML/CFT requirements for insurers

The National Insurance Commission supervises insurance companies and other insurance institutions for AML/CFT/CPF compliance. Its requirements focus on the products most exposed to misuse, particularly life insurance and investment-linked policies, where premiums, early surrenders, and policy loans can be used to move funds.

What it means for your program

• Risk assessment that distinguishes between product lines and distribution channels
• Due diligence on policyholders, beneficiaries, and payers, including at payout
• Monitoring for red flags such as early cancellations, overpayments, and third-party premium payments

Nigerian Financial Intelligence Unit (NFIU) reporting obligations

The NFIU is Nigeria’s central agency for receiving and analyzing financial intelligence, and it disseminates that intelligence to law enforcement and other competent authorities.

Suspicious transaction reports (STRs). Institutions must report to the NFIU when they suspect, or have reasonable grounds to suspect, that funds or a transaction are linked to money laundering, terrorist financing, proliferation financing, or other criminal activity. Reports must be filed within the timelines set by law, and staff must not disclose to the customer that a report has been made or is being considered.

Currency transaction reports (CTRs). Institutions must report cash transactions above the thresholds prescribed for individuals and for corporate bodies, whether the transaction is single or made up of linked transactions.

What it means for your program

• Alert triage and investigation standards that produce well-reasoned, well-documented decisions
• STR narratives that clearly explain who, what, when, where, and why the activity is suspicious
• Controls that capture all reportable cash activity, including aggregation of linked transactions
• Timeliness and quality metrics reported to management

Sanctions screening: UN Security Council and Nigerian sanctions lists

Nigerian institutions must implement targeted financial sanctions under the United Nations Security Council sanctions regimes and the Nigeria Sanctions List maintained under the Terrorism (Prevention and Prohibition) Act, 2022. In practice this means screening, freezing without delay, and reporting.

Institutions with U.S. dollar activity, U.S. correspondent relationships, or international partners often also screen against other lists, such as those maintained by the U.S. Office of Foreign Assets Control (OFAC), because their counterparties expect it.

What it means for your program

• Screening of customers, beneficial owners, and payments against current lists, with timely list updates
• Fuzzy-matching settings that are calibrated, tested, and documented
• Clear procedures for reviewing potential matches, freezing assets, and reporting
• A documented decision on which lists apply to which parts of the business

Nigeria Data Protection Act, 2023

The Act established the Nigeria Data Protection Commission and sets the rules for processing personal data. Compliance programs process large volumes of customer data for due diligence, monitoring, screening, and reporting, so the two frameworks need to work together.

Meeting a legal obligation, such as AML/CFT requirements, is a recognized basis for processing. Institutions still need to apply data protection principles to that processing, including limiting data to what is needed, keeping it secure, retaining it only as long as required, and managing transfers of data outside Nigeria, for example to cloud-based screening or monitoring vendors.

What it means for your program

• Data maps that cover KYC, monitoring, screening, and case management systems
• Retention schedules that reconcile AML record keeping periods with data protection principles
• Due diligence on technology vendors that store or process customer data, including offshore